350-701 Endpoint Security and Identity Practice Test 4 — 15 Questions

Question 1

A security administrator notices that a file initially classified as 'unknown' by Cisco AMP for Endpoints has been later determined to be malicious. Which Cisco AMP feature allows the administrator to see the file's propagation and impacts across endpoints?

Accepted Answer

Device Trajectory. Device Trajectory provides a timeline view of file and process activity, showing the propagation of a threat after it is discovered to be malicious.

Answer

SHA-256 Disposition

Answer

IOC Scanning

Answer

Exploit Prevention

Question 2

An engineer is configuring Cisco ISE for 802.1X authentication. The network has many printers and IP phones that do not support 802.1X supplicant software. Which ISE feature should be used to allow these devices to authenticate?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) allows non-802.1X-capable devices to authenticate based on their MAC address.

Answer

Posture assessment

Answer

Guest access with sponsor portal

Answer

Profiling via DHCP probe

Question 3

A security analyst needs to enforce that all endpoints have antivirus software running and are up-to-date with patches before granting full network access. Which Cisco ISE feature should be used to enforce this policy?

Accepted Answer

Posture assessment. Posture assessment checks endpoints for compliance with security policies (e.g., antivirus status, patch level) before granting access.

Answer

Change of Authorization (CoA)

Answer

Profiling

Answer

TrustSec SGT assignment

Question 4

An organization deploys Cisco ISE for network access control. After successful 802.1X authentication, a user's device is found to be missing critical patches via posture assessment. The administrator wants to dynamically move the user to a remediation VLAN without requiring the user to reconnect. Which ISE capability enables this?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically change authorization attributes (e.g., VLAN, ACL) for an already authenticated session.

Answer

RADIUS Accounting

Answer

MAB reauthentication

Answer

Device Sensor profiling

Question 5

A company wants to implement two-factor authentication for remote VPN access using Cisco AnyConnect. They need a solution that supports push notifications to a mobile app. Which Cisco product meets this requirement?

Accepted Answer

Cisco Duo. Cisco Duo provides multi-factor authentication with push notifications, TOTP, and other methods, and integrates with AnyConnect VPN.

Answer

Cisco SecureX

Answer

Cisco ISE with certificate-based authentication

Answer

Cisco AMP for Endpoints

Question 6

In a Cisco ISE 802.1X deployment, which component acts as the authenticator?

Accepted Answer

Authenticator (switch/WLC). The authenticator is the network device (switch or wireless LAN controller) that enforces authentication before granting access.

Answer

RADIUS server

Answer

Authentication server (ISE)

Answer

Supplicant (client software)

Question 7

A security engineer is configuring Cisco AMP for Endpoints to protect against memory injection attacks. Which feature should be enabled to block exploits that attempt to inject malicious code into legitimate processes?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP protects against memory injection and other exploit techniques by monitoring process behavior.

Answer

IOC Scanning

Answer

Device Trajectory

Answer

File quarantine

Question 8

During a security incident, an analyst needs to isolate a compromised endpoint and perform remote forensic analysis using Cisco AMP for Endpoints. Which capability allows the analyst to execute commands on the endpoint remotely?

Accepted Answer

Remote shell investigation. Remote shell investigation is the correct answer because Cisco AMP for Endpoints includes a feature that allows an analyst to establish a secure, encrypted shell session directly with the compromised endpoint. This enables the execution of arbitrary commands for live remote forensic analysis without requiring additional tools or manual intervention on the endpoint.

Answer

Device Trajectory

Answer

File quarantine

Answer

Process isolation

Question 9

An organization wants to implement privileged access management (PAM) for critical servers. They require just-in-time access and session recording. Which solution integrates with Cisco SecureX to provide these capabilities?

Accepted Answer

CyberArk. CyberArk is a leading PAM solution that integrates with Cisco SecureX to provide just-in-time access, session recording, and password vaulting.

Answer

Cisco Duo

Answer

Cisco AMP for Endpoints

Answer

Cisco ISE

Question 10

Which authentication protocol is used in Cisco ISE for certificate-based 802.1X authentication?

Accepted Answer

EAP-TLS. EAP-TLS is the Extensible Authentication Protocol that uses certificates for mutual authentication.

Answer

LEAP

Answer

EAP-MD5

Answer

PEAP-MSCHAPv2

Question 11

A network administrator configures Cisco ISE to identify devices by analyzing DHCP requests, HTTP user agents, and SNMP queries. Which ISE feature is being used?

Accepted Answer

Profiling. Profiling in ISE uses probes (DHCP, HTTP, SNMP, etc.) to identify device type and attributes.

Answer

TrustSec

Answer

Guest access

Answer

Posture assessment

Question 12

A security team wants to enforce application whitelisting on endpoints to prevent unauthorized software execution. Which Cisco AMP for Endpoints feature can be used to implement this control?

Accepted Answer

Application whitelisting (via AMP policy). Application whitelisting is an endpoint hardening technique that can be enforced using Cisco AMP's advanced policies, including file and application control.

Answer

IOC scanning

Answer

Exploit Prevention

Answer

Device Trajectory

Question 13

A company deploys Cisco ISE for network access control. They need to allow guests to access the internet via a self-registration portal. Which two components must be configured? (Choose two.)

Accepted Answer

Self-registration portal. Guest access in ISE requires a sponsor portal (for approval) or self-registration portal, and integration with the network devices (switches/WLCs) for guest VLAN assignment.

Answer

EAP-TLS authentication

Answer

Posture assessment for guests

Answer

MAB for guest devices

Question 14

An organization wants to deploy endpoint hardening measures. Which three capabilities are provided by Cisco AMP for Endpoints as part of EDR (Endpoint Detection and Response)? (Choose three.)

Accepted Answer

Remote shell investigation. EDR capabilities include file quarantine, process isolation, and remote shell investigation for incident response.

Answer

TrustSec SGT assignment

Answer

Device Sensor profiling

Question 15

A network engineer is troubleshooting 802.1X authentication failures. Which two components are required for a successful 802.1X authentication? (Choose two.)

Accepted Answer

Authentication server (ISE). In 802.1X authentication, the supplicant (client software) initiates the authentication process by sending an EAPOL-Start message, and the authentication server (ISE) validates the client's credentials via RADIUS. Without both, the authentication cannot complete. The supplicant provides identity, while the authentication server makes the final permit/deny decision.

Answer

DHCP server

Answer

DNS server

Answer

RADIUS proxy